Skip to content

in.termal/termalin-web

by termal.in · remote · no sign-in to list tools · v1.0.0 · published by in.termal

Run commands and read/write files on your servers over Termalin's keyless tunnels (hosted MCP).

Deletes · 6Changes · 2
CompareRegistry entry

16 tools: 6 can delete or cancel things, 2 change things and 8 only read.

Scanned Oct 21, 2026

2 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http termalin-web https://termal.in/api/v1/mcp --header 'Authorization: <your-authorization>'

Findings

Matches of fixed checks, with the text they matched.

2 warn
  • Warngenerate_password

    The server marks "generate_password" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The name "generate_password" says "generate": a word for a change.

    What this check looks for
  • Warndata_query

    The server marks "data_query" destructive (destructiveHint: true), and its name says "query", a word for reading.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":true,"idempotentHint":false,"openWorldHint":true}; The name "data_query" says "query": a word for reading.

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

16 tools

Deletes or cancels 6Claude Code: deny
  • data_queryRun a database query on one of your servers — passwordless.Reads private dataReads text others write1 finding

    Why it is in this group

    • The name "data_query" says "query": a word for reading.
    • The description's first verb is "run": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • private-dataThe description's first sentence says "database": it reads databases.
    • private-dataThe input names a database (input.database), and the tool reads: it reads databases.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "data_query" destructive (destructiveHint: true), and its name says "query", a word for reading.

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":true,"idempotentHint":false,"openWorldHint":true}; The name "data_query" says "query": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Run a database query on one of your servers — passwordless. It executes the engine's own client on the host over Termalin's keyless tunnel, using the database's local trust (Postgres peer auth via `sudo -u postgres`, MySQL/MariaDB unix-socket via `sudo mysql`, redis-cli, mongosh, sqlite3) — so no database password is needed or stored anywhere. Read-only by default: only SELECT/SHOW-style statements run unless allowWrites is set (full-access keys only). SQL engines return CSV/TSV with a header. For MongoDB pass a shell expression, e.g. db.products.find({}).limit(20).toArray().

    Annotations the server declares

    • title: Query a database
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • job_startStart a long-running shell command on a server in the background and return a job id right away.Reads text others writeNo findings

    Why it is in this group

    • The name "job_start" says "start": a word for a change.
    • The input takes a statement or command to run (input.command), which can change anything it can reach.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Start a long-running shell command on a server in the background and return a job id right away. Use it for anything that can take more than about a minute — package installs, builds, backups, migrations, large downloads. The job keeps running after this call returns and survives the connection closing; its output goes to a log you read with job_status. The command runs from the login user's home directory.

    Annotations the server declares

    • title: Start a background job
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • job_stopStop a background job started with job_start (asks it to terminate, then forces it after two seconds).Reads text others writeNo findings

    Why it is in this group

    • The name "job_stop" says "stop": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Stop a background job started with job_start (asks it to terminate, then forces it after two seconds). Does nothing if the job already finished.

    Annotations the server declares

    • title: Stop a background job
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • sftp_writeCreate or overwrite a text file on one of your servers over SFTP.Reads text others writeNo findings

    Why it is in this group

    • The name "sftp_write" says "write": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Create or overwrite a text file on one of your servers over SFTP. 'content' is written as UTF-8. Capped at 512 KB; for binary uploads use a terminal/scp instead.

    Annotations the server declares

    • title: Write a file
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • ssh_execRun a single shell command on one of your servers and return its combined output and exit code.Reads text others writeNo findings

    Why it is in this group

    • The name "ssh_exec" says "exec": a word for a change.
    • The input takes a statement or command to run (input.command), which can change anything it can reach.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Run a single shell command on one of your servers and return its combined output and exit code. Runs keyless over Termalin's tunnel — no SSH key, and the server needs no open inbound port. Each call is a fresh shell (cd does not persist — chain with &&). Keep a call under about 90 seconds: for anything longer (installs, builds, backups) use job_start and check on it with job_status.

    Annotations the server declares

    • title: Run a command over SSH
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • ssh_exec_manyRun the same shell command on several of your servers at once and return each server's output and exit code.Reads text others writeNo findings

    Why it is in this group

    • The name "ssh_exec_many" says "exec": a word for a change.
    • The input takes a statement or command to run (input.command), which can change anything it can reach.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Run the same shell command on several of your servers at once and return each server's output and exit code. Use it to compare or check a fleet (disk space, versions, a service's state) in one call instead of one call per server. Up to 10 servers; the same 90-second limit as ssh_exec applies.

    Annotations the server declares

    • title: Run a command on several servers
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
Changes things 2Claude Code: ask
  • generate_passwordGenerate a strong random password — handy when creating a user or setting a password on a server.1 finding

    Why it is in this group

    • The name "generate_password" says "generate": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "generate_password" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The name "generate_password" says "generate": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Generate a strong random password — handy when creating a user or setting a password on a server. Returns the password only; nothing is stored.

    Annotations the server declares

    • title: Generate a password
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • server_metricsNumbers Termalin's monitoring collects from the user's servers every minute, without running anything now: CPU, memory, disk, load, network, the busiest processes, failed services,…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Numbers Termalin's monitoring collects from the user's servers every minute, without running anything now: CPU, memory, disk, load, network, the busiest processes, failed services, containers, certificates. Without `host`: one line per server with its latest numbers. With `host`: that server's latest sample in full and the average and peak over the last `hours` (default 6). Use it for 'how is the server doing' and 'what happened at night' before reaching for ssh_exec. Covers servers with metrics switched on.

    Annotations the server declares

    • title: Read server metrics
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
Only reads 8Claude Code: allow
  • alerts_listWhat Termalin's monitoring says is wrong with the user's servers right now (disk filling up, memory or load pinned, a failed service, a restarting container, a certificate about to…Reads text others writeNo findings

    Why it is in this group

    • The name "alerts_list" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    What Termalin's monitoring says is wrong with the user's servers right now (disk filling up, memory or load pinned, a failed service, a restarting container, a certificate about to expire, a server offline), plus what cleared in the last seven days. Start here when asked how the servers are doing. Covers servers with metrics switched on.

    Annotations the server declares

    • title: List server alerts
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • data_schemaDescribe one table of a database on one of your servers: its columns with type, whether they can be empty, default value and primary key.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The description's first verb is "describe": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "describe" and "table": it reads databases.
    • private-dataThe input names a table (input.table), and the tool reads: it reads databases.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Describe one table of a database on one of your servers: its columns with type, whether they can be empty, default value and primary key. Call it before writing a query against a table you have not seen. Works for postgres, mysql, mariadb and sqlite.

    Annotations the server declares

    • title: Describe a table
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • data_tablesList the tables / collections / keys of a database on one of your servers — passwordless, over the same local-client path as data_query.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The description's first verb is "list": a word for reading.

    What it can reach

    • private-dataThe name "data_tables" says "table": it reads databases.
    • private-dataThe description's first sentence says "list" and "table": it reads databases.
    • private-dataThe input names a database (input.database), and the tool reads: it reads databases.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List the tables / collections / keys of a database on one of your servers — passwordless, over the same local-client path as data_query.

    Annotations the server declares

    • title: List tables
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hosts_listList the servers reachable through Termalin (your tunnel agents).Reads text others writeNo findings

    Why it is in this group

    • The name "hosts_list" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List the servers reachable through Termalin (your tunnel agents). Returns id, name, whether the server is online, the user commands run as, when it was last seen, its country, and ownerNote — what the owner wrote about that server for you (what it is, what to leave alone); follow it. Use the id (or the exact name) as 'host' in the other tools.

    Annotations the server declares

    • title: List servers
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • job_listList the recent background jobs on a server (newest first): id, state, start time and the command.Reads text others writeNo findings

    Why it is in this group

    • The name "job_list" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List the recent background jobs on a server (newest first): id, state, start time and the command.

    Annotations the server declares

    • title: List background jobs
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • job_statusCheck a background job started with job_start: whether it is still running or finished (with its exit code), when it started, and the last lines of its output.Reads text others writeNo findings

    Why it is in this group

    • The name "job_status" says "status": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Check a background job started with job_start: whether it is still running or finished (with its exit code), when it started, and the last lines of its output.

    Annotations the server declares

    • title: Check a background job
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • sftp_listList a directory on one of your servers over SFTP.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "sftp_list" says "list": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "list" and "directory": it reads files.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List a directory on one of your servers over SFTP. Returns each entry's name, whether it's a directory, size and modified time. Runs keyless over Termalin's tunnel, like ssh_exec.

    Annotations the server declares

    • title: List a directory
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • sftp_readRead a text file from one of your servers over SFTP and return its contents.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "sftp_read" says "read": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "read" and "file": it reads files.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Read a text file from one of your servers over SFTP and return its contents. Files over 512 KB or non-text (binary) files are refused — use ssh_exec (e.g. sed/tail) for those.

    Annotations the server declares

    • title: Read a file
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged outbound.

Reads private data5
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write15
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out0
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Looked at Oct 22, 2026, 14:49 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable
yes
HTTP status of an anonymous initialize
200
tools/list served without credentials
yes
Tools that change things, listed without credentials
8
Protocol version
2025-06-18
WWW-Authenticate on 401
not observed
resource_metadata in WWW-Authenticate
none
RFC 9728 protected resource metadata
https://termal.in/.well-known/oauth-protected-resource
Authorization servers
https://termal.in
Legacy HTTP+SSE transport
no
Dynamic client registration
yes
Client ID metadata documents
no
  • HighThe whole server

    The endpoint served tools/list without credentials, and the list has 8 tools that change things (6 destructive, 2 write). Whether a call also works without credentials was not tested: tools are never called.

    Matched text

    https://termal.in/api/v1/mcp: tools/list returned 16 tools to an anonymous client, including ssh_exec (destructive), ssh_exec_many (destructive), job_start (destructive), job_stop (destructive), sftp_write (destructive) and 3 more

    What this check looks for

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http termalin-web https://termal.in/api/v1/mcp --header 'Authorization: <your-authorization>'

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__termalin-web__hosts_list",
      "mcp__termalin-web__job_status",
      "mcp__termalin-web__job_list",
      "mcp__termalin-web__alerts_list",
      "mcp__termalin-web__sftp_list",
      "mcp__termalin-web__sftp_read",
      "mcp__termalin-web__data_tables",
      "mcp__termalin-web__data_schema"
    ],
    "ask": [
      "mcp__termalin-web__generate_password",
      "mcp__termalin-web__server_metrics"
    ],
    "deny": [
      "mcp__termalin-web__ssh_exec",
      "mcp__termalin-web__ssh_exec_many",
      "mcp__termalin-web__job_start",
      "mcp__termalin-web__job_stop",
      "mcp__termalin-web__sftp_write",
      "mcp__termalin-web__data_query"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as termalin-web. Review it before you use it.

Capability tags behind 15 rules
  • mcp__termalin-web__hosts_list untrusted-input
  • mcp__termalin-web__ssh_exec untrusted-input
  • mcp__termalin-web__ssh_exec_many untrusted-input
  • mcp__termalin-web__job_start untrusted-input
  • mcp__termalin-web__job_status untrusted-input
  • mcp__termalin-web__job_stop untrusted-input
  • mcp__termalin-web__job_list untrusted-input
  • mcp__termalin-web__server_metrics untrusted-input
  • mcp__termalin-web__alerts_list untrusted-input
  • mcp__termalin-web__sftp_list private-data, untrusted-input
  • mcp__termalin-web__sftp_read private-data, untrusted-input
  • mcp__termalin-web__sftp_write untrusted-input
  • mcp__termalin-web__data_query private-data, untrusted-input
  • mcp__termalin-web__data_tables private-data, untrusted-input
  • mcp__termalin-web__data_schema private-data, untrusted-input